3c3fdd9e430b64fb501a1a4ea1e9f2e7ca767d39203b87d16b5423a7366c57ed

Analysis

max time kernel
136s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

293bcd3f24b90eaff5b4e55962b58f4b_JaffaCakes118.html
Size

349KB
MD5

293bcd3f24b90eaff5b4e55962b58f4b
SHA1

a22269ac50b02d9cd7815dc160e2bbb407fe6d3e
SHA256

3c3fdd9e430b64fb501a1a4ea1e9f2e7ca767d39203b87d16b5423a7366c57ed
SHA512

8a7f358fc7a51ecc29a52dcf7197022a157e1e046fd9e4eaf4454d05804cfabbdcf0954993b122902c3d950a11d530b10b782eb6cd98b5c8ca1fc44578d2e226
SSDEEP

6144:SFsMYod+X3oI+Yh0sMYod+X3oI+YAsMYod+X3oI+YQ:Y5d+X3K5d+X3Y5d+X3+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421407289"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7023741bf0a1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d1000000000200000000001066000000010000200000003ca386c7053c81d3df04a4a67549245a22b9c183a1207ced72c2f5c2ebf642a1000000000e80000000020000200000005974d1f94e873007cb8b0350e0df3b347e487cd55a38121d1e041a5d85cfa7139000000012d91c47f940434331af3c910e991905e3489c9965d3bf66a1b0a2140435d44d422c7414c44ae033557ef448107e074f25c1851409c319e426d199cf6414cbfa086eb2ae59b597e5893584de9661742abc53ef386d0212180ad03bb20e45bb5e2e7c7fc2938ab2a8b9009e93686c565160080912e2ab642d806057a67a3adaa21b4d3d9ac1aae6175f0e66c648786d47400000009d1744e5fd3cebf42f394f47ecc736bc416f59dcd50c33a846662a27b525a7d40d5aa0e2f101f3cbb6ff9826273b6c1b5bea71d98684bc806df4992da1ecef42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a96537aabf3a5434ef1dcfdc1cb19d6a2d16f096741d730974686654baec048f000000000e80000000020000200000008db90f13824284b6d3e49a9220bc552f5b6e0b4dd7e7e7acbdeaaf0147e5ff65200000006a48cd654319e5fcdb19989415d89a2f5af68d0ed8635b9660410162f4ef2c6d40000000099cc4a392f2c5e30ae436d3272c013a027de8a84e1b06c5cd72827a2ca3cf46976aa96834d49d047d63d05c75e9731ac2f990cdd29c7fc0bdcd525080ff4067	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07E61841-0DE3-11EF-85C1-E69D59618A5A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2888	iexplore.exe
2888	iexplore.exe
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE
2400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2400	2888	iexplore.exe	28
PID 2888 wrote to memory of 2400	2888	iexplore.exe	28
PID 2888 wrote to memory of 2400	2888	iexplore.exe	28
PID 2888 wrote to memory of 2400	2888	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\293bcd3f24b90eaff5b4e55962b58f4b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2888 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0653206f20a27d1c63141b2ffaf61e0c

SHA1
b8e8f56b8d636f3d10e50351a6740e5750c9d384

SHA256
de1c339f945f10113ab5b99ce11c84ed673ad683fdb83d1694d0eeaaa4318fc0

SHA512
a53dbc0eb0274465db1db4acebbdb1afa6dd61704dd74167926c47dfe7696b85d62c1b6ef0a39b64320ff87071e6929e20040497ad334bb6d77173f9f2198c20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94a106a605a6566d7e94c7bacf4a362e

SHA1
0022b3f186a07ddc421a8d960182b4e72b756657

SHA256
cb0998a03b7ddcf3148bb9084bf126e9805799bdbe1e0d9a4139f504525b5a8a

SHA512
3f1d5ea586f902a7b005555d810cc69e0104faeed9fcf848b72cb8937b8db9433471047aaf60e02995f8ebfd99f682a34753ff729516b1a7c5de71b97ab14d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9037e15f6f4f5a1b55b813350d8f3623

SHA1
1ac8aa440b94e29abc5634458c0e43eabb6746a9

SHA256
ab499ec23626b460f5ffa05fba1b2204c82ae296311d6c5fd50279a5f125e21e

SHA512
d2010c9f24ac59ba5e25176e006cc5e373d9a8c5715313517978f377fdc0d76c4531a2ce238140ef66b2af257705379a5d0f4ac2cbeed96331bab86218f1f16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
387ffb8e57d80eab911e3ff713ef5b28

SHA1
22eb27ccf894c60d0042ed40d893612fb5136bae

SHA256
6bacdd32948298c3d3c8e996a10aa52e9dfb64201efa0b625498788e48d3b382

SHA512
7f34b7b5a130c65ac94682ba88307ea8c1a44b12d2bc2c273659adf160bc80b41eb253ea1e5328cc9d27a388720e528f59a6aa3b7405a2a4bfe6497bb36431e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bfb36dc7a9a8cfcd77b2fd2593718a40

SHA1
4a2b68090a676853eff51f44349b83c47602bc14

SHA256
06a169fd287eb49969f97f177d643696a4adb8be9597762ee29f6ec2ea2c2b3e

SHA512
fcd17d053983329f02ed451886b8cb3911c1e94fea7bf9d5b88d03d854f8ecadfe549fbf622f87bc80adfa6665ff5a7e57140dedf86f51b1e8c7ed7c38a37b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bbb84aef21029ee346d860352409ab2a

SHA1
50a95d2025a69bda2b08f60d98fe874d5447ef5c

SHA256
ac7cc7b26a6183617f5dc34146454b40d05ce186f7740b00aec097be947bade2

SHA512
5cca8b0538503d602ec5404fb48163e41dc68a9171d06f83b74649d692df1d109bfd48d064cdf6716b8ef9f9681b49b3b3980672100f2b305eef5637f7e01680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea9f70c69592d9131af4b3bf12f78b6a

SHA1
3a6a910982486e53f53e61e3dfac862083bbeea1

SHA256
4d9d05ca38f5c2c28f5309aad37add33b73cf43c6a66d356bf440466e6a43fe9

SHA512
149d1729ae5c5ea37fe0e4d195199f7d93cbe69205074efa5fa524ff23e979982d446efc1da0c928f10c531bf52b33e7461180a7e013696d6e96d0d85872be2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b384852b820f30f23f970f755d8e2d55

SHA1
e1474a91608495d4dccc143d3c626bb19c6b25bd

SHA256
c5de7f329d34ad068ddf5975b66b6f9c6e7bff1b43462cb07214702ba993d58d

SHA512
1a496ce90717a895a10f2776a021ec667c8ebe58a394451f1a9cf380630521f49ef08432bb5f36eceedfcda96f28a082f843961077c2b2fe9a303d78b56e3602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1935ce79d7c82209fe8c9870db816cb8

SHA1
a896045e798b3cdfd7e4694f118d852966dc0a4c

SHA256
550e8c699eff9b718e3f7419d08b6e6aca766bccbbf5750c559848bcc24f4120

SHA512
821018cef148daa40cf329c0f319f78d66e312bf75b48d762f645de203a45628279a5481050a164c644be4d8637a51f2af4a8807109d52167311daeef61194cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6de1354f008a0e8292bb03d2d298cb94

SHA1
ce4378a0569c819bbeaffc49457307a526181773

SHA256
2d99401ffd65afdba853d2f1855b819b75fb18ca21d502ec79749be0486f6dca

SHA512
1e800f693d376169f512f39f36f2a1fa98b4e061a0bdf2623aedea5da438c65ef55dfd066a8d67ba472f186053e98e294c2f2afce18432dd050607de55e8141a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7857ac52b4244af991fa34208e18c7eb

SHA1
eb37e21c9df4b077b3133ba04c36d8ad1d5344c6

SHA256
afa065b18d1a8148f474e9f52844e8d8a22d15da920c512d203eadb6579a6891

SHA512
d5f9151517a644d4b992e95aadd9c49b204c87365d03bc384500d07bdef729ae2ff6e152cde605ce2f5799130afc2c56b42f7c287042fa32daabac51d9ab90db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04e6457262803901273a83bf8b4d281e

SHA1
b341bfba915e5457b7264b1dcc228f6c2798b90e

SHA256
30e43d6902607272fa99d3b75b1f499ad2104e2322cc277dbb255768bc0c9dc8

SHA512
74a4435b185323b4ca4eb7e956767da7f592cf19e9cd51e78244b7857839d9dade869eca80adab2c75b55c22a9b47910079676a0123fd647acd41453a5deac51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49304b9dc40ff1baf42c0cbf24bea444

SHA1
0a502fc8f48dd05f36df945284255a8627a5f3c1

SHA256
11a89b981a581386b853dcfb6a3fe9277ca717a3b74b6f878449e1d048715ae2

SHA512
ad28a0b2477e8e495090eea188d090fe8b100a4d1173ca16f15b83b0b245649750dda612190fb87bf7af2c0fbb2b3e1bff967e10f59a6556af8a0b8cc2fe1de5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cda0d2cebc3e24258233c86aa4f661ac

SHA1
373a3a8bf0fce4c064d50b2572d432578963a8aa

SHA256
24963aa437ac457a43dcd497af5554c859d14541cb30a9d7e1106f606bf7ca57

SHA512
ddb9d093a340079ff79546c69109574b0aa768dc6c7930ef12e88c48cd0ec1bb01e004f7e5f086827d3f1e9282bd7e7b63cf45af8d2e146b24e6433324139395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a234bb01108a1d9f1da190b33a36e7c

SHA1
80145dd1c70bd43d9a4001ffc5d140a040da90bc

SHA256
6c69c76c969e993b772922d2f9e289e9bf40846a8659ae2130d741771bf3de92

SHA512
afc891d58f3eeb35feb45a3b28cde0e763f397a001451ff221344e4bbcfdbc96dc1d0293fd0578d67c72f00150ef09e5e48663e6158d88f13afc260782bc55f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab147A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14DD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit